Track: Cybersecurity

Abstract

When firms are in an information sharing alliance, the amount of information that the firms provide may vary due to multiple factors, such as size, technology investment capacity, and the information security environment for the firm. Hence, in many cases even the well-intended firms are unable to share the same level of information as they receive from other firms. We refer to such a situation as asymmetric information sharing. Given this setting, information sharing alliances are confronted with the challenges of maintaining a fair information sharing environment, which would ensure proportional returns for firms in the alliance. In the current practice, firms are typically charged a membership fee by Information Sharing and Analysis Centers for participating in information sharing activities. However, the application of a membership fee does not totally address the problems that may arise due to asymmetric information sharing. First, the level of membership fee being charged does not reflect the level of information provided or received by individual firms. Second, no monetary compensation to firms that share more information is provided, which forms a barrier for continuous information sharing. Lastly, the membership fees for ISACs do not consider the willingness to pay attitudes of firms that may prefer to purchase information from other firms. In this study we aim to address these issues by seeking answers to the following research questions: (1) What fair price should a firm pay participating information sharing in asymmetric sharing environment? and, (2) How would the price of information vary under different pricing strategies and other influencing factors? To this end, we develop analytical expressions of a firm’s payoffs under an asymmetric information sharing environment. We also analyze the pricing of information as a function of a firm’s technology investment level, its information sharing level, and the marginal cost of information sharing.